OpenLeash Human-in-the-Loop for AI Agents: Detecting and Containing Risky Agent Actions

Autonomous AI agents are no longer a lab curiosity — in 2026 they're provisioning infrastructure, executing shell commands, calling internal APIs, and moving data across enterprise environments. That operational power is exactly what makes them a top-tier attack surface. A single prompt-injection payload in a support ticket, a poisoned document in a retrieval pipeline, or a compromised upstream tool server can turn a helpful agent into an insider threat with API credentials.

This week, SecurityWeek reported that OpenLeash, an open security tool for AI agents, now intercepts potentially dangerous agent actions before they execute — blocking clearly malicious operations outright and escalating to a human approval workflow when intent is ambiguous. This is a meaningful shift in agentic AI defense: rather than trusting static allowlists or hoping the model refuses bad instructions, OpenLeash inserts a deterministic control plane between the agent's reasoning and its real-world side effects.

For defenders, the lesson goes beyond one tool. Whether you deploy OpenLeash or build equivalent controls, you need three things: visibility into what your agents are doing, detection coverage for the behaviors that indicate compromise, and a containment model that assumes the agent's intent layer can be subverted. This post covers all three.

Technical Analysis

The Threat Model: Why AI Agents Are Different

Traditional application security assumes code does what developers wrote. AI agents break that assumption — their behavior is dynamically shaped by natural-language input, and adversaries have learned to exploit it:

• Indirect prompt injection — malicious instructions embedded in emails, web pages, documents, or tool responses that the agent ingests, causing it to exfiltrate data, run commands, or call attacker-controlled endpoints.
• Tool abuse — agents with shell, file-system, browser, or API tools can be steered into destructive or exfiltrative actions (mass file reads, curl to external hosts, cloud metadata queries).
• Credential and secret access — agents often run with broad API keys, OAuth tokens, or cloud IAM roles. A hijacked agent inherits all of it.
• Chained autonomy — multi-agent pipelines let one compromised agent delegate malicious tasks to others, amplifying blast radius while obscuring attribution.

What OpenLeash Does

According to the SecurityWeek report, OpenLeash sits as an interception layer between an agent and its action surface. Its decision model has two tiers:

1. Deterministic blocking — actions matching clearly dangerous patterns (e.g., destructive filesystem operations, known exfiltration behaviors) are denied outright, without waiting on a human.
2. Human-in-the-loop escalation — when an action is risky but intent is uncertain, execution is paused and a human operator is asked to approve or reject it. This addresses the hardest problem in agent security: context-dependent actions like "delete these records" or "email this file" that are legitimate in one workflow and catastrophic in another.

This mirrors a pattern mature security teams already use for privileged access (just-in-time elevation, break-glass approval) applied to non-human identities. It acknowledges a hard truth we reinforce in every red team engagement involving LLM systems: the model's judgment is not a security boundary. A control that lives outside the model's reasoning loop is.

Exploitation Status

This is not a vulnerability disclosure — no CVE is associated with this news, and OpenLeash is a defensive capability rather than a patch. However, the threat it addresses is active and current: prompt injection remains the top entry in the OWASP Top 10 for LLM Applications, and throughout 2025 and into 2026 we've seen sustained real-world incidents of agents manipulated into data exfiltration, unauthorized transactions, and supply-chain actions via poisoned tool outputs. Any organization running agents with tool access and no interception layer should treat this as an unmitigated exposure, not a theoretical risk.

Detection & Response

Whether or not you adopt OpenLeash, your SOC should be hunting for the behaviors a compromised agent exhibits. The highest-fidelity signals are at the host and network layer, where agent runtimes (Python, Node.js, containerized frameworks) touch the operating system.

The Sigma rules below target the two most reliable host-level indicators of agent compromise: agent runtimes spawning interactive shells/download tools, and agent processes accessing credential material they have no business reading.

---
title: AI Agent Runtime Spawning Shell or Download Utility
id: 3f8a2c14-7b91-4e56-bd23-9a1c4e7f5d02
status: experimental
description: Detects Python or Node.js processes — common AI agent runtimes — spawning shells or download/credential utilities, consistent with prompt-injection-driven command execution.
references:
  - https://www.securityweek.com/openleash-adds-a-human-check-to-risky-ai-agent-actions/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\uvicorn.exe'
      - '\streamlit.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate agent workflows that shell out to system tools (tune by parent command line and working directory)
  - Build and CI runners
level: high
---
title: Agent Process Accessing Credential or SSH Key Material
id: 8c1d5e67-2a4f-4b98-cd31-6e9b2a4f8c17
status: experimental
description: Detects agent runtime processes reading SSH private keys, cloud credentials, or browser credential stores — a strong indicator of agent hijacking or malicious tool use.
references:
  - https://www.securityweek.com/openleash-adds-a-human-check-to-risky-ai-agent-actions/
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_cmd:
    CommandLine|contains:
      - '.ssh\id_rsa'
      - '.ssh\id_ed25519'
      - '\.aws\credentials'
      - '\.azure\'
      - 'Login Data'
      - 'cookies.sqlite'
      - 'netrc'
  condition: selection_parent and selection_cmd
falsepositives:
  - Legitimate automation deploying via SSH (scope to known agent service accounts and hosts)
level: critical

For Microsoft Sentinel and Defender environments, this KQL hunts across both Windows and ingested Linux Syslog/CEF data for agent runtimes reaching outbound to unusual destinations or spawning execution chains — the network signature of agent-driven exfiltration:

let agentRuntimes = dynamic(["python.exe", "python3.exe", "python", "python3", "node.exe", "node"]);
let lookback = 7d;
// Windows endpoint view: agent runtimes spawning execution/download children
let hostChains = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ (agentRuntimes)
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","curl.exe","wget.exe","bash","sh")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine;
// Network view: agent runtimes making outbound connections to non-RFC1918 destinations
let egress = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ (agentRuntimes)
| where RemoteIPType == "Public"
| summarize Connections=count(), Destinations=make_set(RemoteUrl, 20), Ports=make_set(RemotePort, 10)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine;
hostChains
| join kind=leftouter (egress) on DeviceName
| sort by TimeGenerated desc

For Linux-heavy agent deployments (the most common case — agents run in containers and VMs), Velociraptor gives you fleet-wide visibility into live agent processes with suspicious command lines and their active network connections:

-- Hunt for AI agent runtimes with risky command lines and outbound connections
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ 'python|node' OR Exe =~ 'python|node')
  AND CommandLine =~ 'curl|wget|nc |ncat|base64|/dev/tcp|ssh |scp |aws s3|gsutil|az storage'

-- Correlate: agent processes holding ESTABLISHED connections to external hosts
SELECT Pid, Name, Path, Status, RemoteAddress.IP AS RemoteIP, RemoteAddress.Port AS RemotePort
FROM netstat()
WHERE Name =~ 'python|node'
  AND Status =~ 'ESTABLISHED'
  AND NOT RemoteIP =~ '^(10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|127\\.)'

The Bash script below gives you a quick audit-and-harden pass on a Linux host running agents: it inventories live agent processes, flags risky command lines, and applies a default-deny egress posture for a dedicated agent service account (the same least-privilege model OpenLeash enforces at the action layer, applied at the network layer):

#!/bin/bash
# Agent runtime audit + egress hardening — run on hosts running AI agents
set -euo pipefail
AGENT_USER="svc-aiagent"

echo "=== [1] Live agent runtime processes ==="
ps -eo user,pid,ppid,cmd | grep -E 'python|node' | grep -v grep

echo "=== [2] Agent processes with risky command lines ==="
ps -eo user,pid,cmd | grep -E 'python|node' | \
  grep -Ei 'curl|wget|nc |ncat|base64|/dev/tcp|ssh |scp |aws |gsutil|az ' | grep -v grep || echo "None found."

echo "=== [3] Established outbound connections from agent runtimes ==="
ss -tnp state established 2>/dev/null | grep -E 'python|node' || echo "No established agent connections."

echo "=== [4] Enforce default-deny egress for agent service account ==="
# Allow loopback + approved LLM/tool endpoints only; everything else dropped
iptables -C OUTPUT -m owner --uid-owner "$AGENT_USER" -o lo -j ACCEPT 2>/dev/null || \
  iptables -A OUTPUT -m owner --uid-owner "$AGENT_USER" -o lo -j ACCEPT
iptables -C OUTPUT -m owner --uid-owner "$AGENT_USER" -p tcp -d api.anthropic.com --dport 443 -j ACCEPT 2>/dev/null || \
  iptables -A OUTPUT -m owner --uid-owner "$AGENT_USER" -p tcp -d api.anthropic.com --dport 443 -j ACCEPT
iptables -C OUTPUT -m owner --uid-owner "$AGENT_USER" -j LOG --log-prefix "AGENT-EGRESS-DENY: " 2>/dev/null || \
  iptables -A OUTPUT -m owner --uid-owner "$AGENT_USER" -j LOG --log-prefix "AGENT-EGRESS-DENY: "
iptables -C OUTPUT -m owner --uid-owner "$AGENT_USER" -j DROP 2>/dev/null || \
  iptables -A OUTPUT -m owner --uid-owner "$AGENT_USER" -j DROP

echo "=== Done. Alert on AGENT-EGRESS-DENY log entries in your SIEM. ==="

Remediation

This is a capability gap rather than a patchable CVE, so remediation means architectural hardening. Prioritize in this order:

1. Insert an interception layer between agents and actions. Evaluate OpenLeash or an equivalent policy-enforcement proxy. The non-negotiable property: the control must live outside the model's reasoning loop. Deterministic blocking for known-bad patterns; human approval for ambiguous, high-impact actions (deletion, external sends, financial transactions, infrastructure changes).
2. Scope agent credentials to the minimum viable surface. Dedicated service accounts per agent, short-lived tokens, no shared API keys, no standing cloud admin roles. If an agent is hijacked, its blast radius should be embarrassing, not existential.
3. Enforce egress filtering on agent workloads. Agents need to reach a small, enumerable set of LLM and tool endpoints. Default-deny everything else and alert on denied attempts — exfiltration almost always requires egress.
4. Sandbox execution tools. Shell and code-execution tools should run in ephemeral, network-restricted containers with read-only filesystems wherever possible. Treat every agent-executed command as untrusted user input — because, under prompt injection, it literally is.
5. Log every tool call with full context. Capture the triggering input, the agent's planned action, the policy decision, and the human approver (when applicable). These logs are your forensic trail when — not if — you investigate a suspected agent compromise.
6. Red team your agents. Prompt injection, tool poisoning, and chained-agent abuse should be in your next engagement scope. If your pentest provider isn't testing your agentic workflows in 2026, ask why.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub